JP2005011326A - Obfuscation of spam filter - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system and method for obfuscating a spam filtering system to hinder reverse engineering of a spam filter and/or to mitigate a spammer from finding out a message that consistently gets through a spam filter almost every time. <P>SOLUTION: This system includes a randomization component that randomizes a message score before the message is classified as spam or non-spam in order to obscure the functionality of a spam filter. The randomization of the message score can be accomplished in part by adding a random number or pseudo-random number to the message score before the message is classified as spam or non-spam. The number added thereto can vary depending on at least one of several input types such as time, user, message content, and hash of the contents of the message, and the hash of particularly important features of the message. Alternatively, multiple spam filters can be deployed rather than a single best spam filter. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to systems and methods for reducing spam transmission, and more particularly to preventing spam filter reverse engineering and / or preventing spammers from modeling and predicting spam filter performance.

  With the advent of global communication networks such as the Internet, there are business opportunities for obtaining a huge number of potential customers. Electronic message communications, and in particular electronic mail, are becoming increasingly popular as a means of disseminating unwanted advertisements and promotions to network users (also called “spam”).

  Radicati Group, a consulting and market research company. Inc. According to the estimate, as of August 2002, 2 billion junk mail messages are sent every day. This figure is expected to triple every two years. Individuals and entities (businesses, government agencies, etc.) are increasingly annoying and often uncomfortable with junk messages. Spam thus threatens the use of computers that are currently or soon to be trusted.

  Common techniques used to deter spam require the use of filtering systems / methods. Proven filtering techniques are based on machine learning techniques. The machine learning filter assigns incoming messages a probability that the message is spam. In this approach, features are generally extracted from two classes of message examples (eg, spam messages and non-spam messages), and a learning filter is applied to probabilistically identify differences between the two classes. Because many message characteristics relate to content (eg, the subject of the message and / or the entire body of words and phrases), this type of filter is commonly referred to as a “content-based filter”. These types of machine learning filters typically use exact match techniques to detect and identify spam messages from appropriate messages.

US Pat. No. 6,161,130 US Pat. No. 6,023,723

  Unfortunately, spammers are constantly finding ways to avoid traditional spam filters, including those that use machine learning systems. For example, spammers use mathematical processing and continuous email modification to test and predict the performance of spam filters. In addition, the general public has a lot of information available that explains how a general spam filter works. Some Internet services even offer to pass a message through a particular filter and return the decision of each such filter. Thus, spammers have the opportunity to pass spam through various known spam filters and / or modify the message until the message passes through the filter successfully. Given the above, the spam protection provided by these conventional filters is limited.

  The following presents a simplified summary of the invention in order to provide a basic understanding of some aspects of the invention. This summary is not an extensive overview of the invention. It is not intended to identify key / critical elements of the invention or to delineate the scope of the invention. Its sole purpose is to present some concepts of the invention in a simplified form as a prelude to the more detailed description that is presented later.

  Traditional machine learning spam filters can be reverse engineered by spammers, which allow spammers to find messages that are not caught by the filter. Furthermore, if the spam filter always captures the same message regardless of the user, spammers can easily find messages that pass through by trial and error. After finding the message, spammers can use filters to send messages to potentially millions of people. Without some form of spam filter modification, this form of spammer trick can continue forever.

  The inventive subject matter provides a system and method that facilitates obfuscation of spam filters, thereby making it more difficult for spammers to reverse engineer and / or find messages that always pass through the filter. The present invention essentially provides a method for modifying the behavior of spam filters. This can be achieved in part by adding a randomization factor to the spam filtering process.

  Most conventional spam filters process a message and return some score for the message. This can be a message probability, an arbitrary score, a message probability log, a degree of match between the current message and a non-spam message, or any other number. A score above a certain threshold is labeled as spam in some way. Such labels include, but are not limited to, deleting, moving to special folders, challenges, and / or marks. Thus, one technique for modifying the behavior of the spam filtering process involves randomization of message scores. Randomization includes, but is not limited to, adding a number to the score and / or multiplying the score by some factor, such as 1.1 or 0.9.

  A second approach to randomization involves the use of time. More specifically, the random number added to the message score varies with and / or depends on the current time or current time increment. For example, the randomization can be programmed to use a different random number every 15 minutes, or every other desired time increment. Alternatively, the random number can be changed as the time changes. As a result, spammers, for example, are near the threshold (considered as spam or non-spam) and were prevented from passing through, but after a slight (eg minor) modification, the filter It can be seen that it is difficult to determine whether the message that has passed through has changed due to modification or due to arbitrary factors.

  A third approach to filter randomization depends in part on the user and / or domain receiving the message. For example, by using a random number that depends on the user, the spammer will find a message that only reaches the test user and not other users. Spammers are therefore more burdensome to test messages.

  Message content is another aspect of randomization according to the present invention. For example, a random number can be calculated based on the content of at least a part of the message. A related technique is the hash method. The hash of the message is a pseudo-random number that is deterministically generated from the content, so that minor changes to the content can result in significant changes to the hash. If a spammer attempts to reverse engineer a message, a slight change in the message content will result in a relatively large change in the message score. Alternatively, or in addition, certain features of the message whose contributions to the score of the message exceed a threshold can be extracted and hashed. This hash can then be used as an input to a random number generator, thereby making it more difficult to find the most important feature contributions.

  It should be further noted that although randomization can be added to the spam filtering process, it is important to do so in a controlled manner. In particular, if a spam filter occasionally passes messages that are clearly spam, a sensible user will be hesitant. Conversely, if an apparently appropriate message is sometimes tagged as spam, a sensible user will be hesitant again. Thus, the inventive subject matter helps influence messages that are “close” to spam or non-spam boundaries. In other words, the randomization of the filtering process has essentially no effect on messages that are clearly spam or clearly non-spam. Instead, it affects the filtering of near-threshold and / or threshold messages between non-spam and spam.

  Finally, instead of using an optimal single spam filter, multiple spam filters can be used to prevent spammers from modeling and predicting spam filter performance. Using multiple spam filters forces different aspects of the message to be inspected before classifying the message as spam or non-spam. Thus, spammers who reverse engineer a filter or find a message that passes through a filter may not always pass through a different filter. Further, the selection of which filter to use to process and classify messages can include any of the randomization techniques described herein above, or a combination thereof.

  To the accomplishment of the foregoing and related ends, certain embodiments of the invention are described herein in connection with the foregoing description and the accompanying drawings. However, these aspects are merely illustrative of the various ways in which the principles of the invention may be used and the invention includes all such aspects and their equivalents. Other advantages and novel features of the invention will become apparent from the following detailed description of the invention when read in conjunction with the drawings.

  The invention will now be described in connection with the drawings. In the drawings, like reference numerals denote like elements throughout the drawings. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent that the invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the present invention.

  As used in this application, the terms “component” and “system” shall refer to computer-related entities, either hardware, a combination of hardware and software, software, or running software. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer. By way of illustration, both an application running on a server and the server are components. One or more components may be present in a process and / or thread of execution, and one component may be located on one computer and / or distributed between two or more computers. it can.

  The inventive subject matter incorporates various inference schemes and / or techniques in connection with generating training data for machine-learned spam filtering. As used herein, the term “inference” generally refers to the process of inferring or inferring the state of a system, environment, and / or user from a set of observations captured via events and / or data. Point to. For example, inference can be used to identify specific content or actions, or to generate a probability distribution over states. Inference can be probabilistic, i.e., calculating a probability distribution over the state of interest based on data and event considerations. Inference also refers to the techniques used to create higher level events from a set of events and / or data. With this reasoning, a set of observations is made whether events are closely related in time or whether events and data are derived from one or more sources. New events or actions are constructed from the recorded events and / or stored event data.

  The term message is used extensively throughout this specification, but the term is not limited to email itself, and can be appropriately modified and distributed across any suitable communications architecture. It should be understood that any form of electronic message communication can be included. For example, a conference application (interactive chat program, instant message program, etc.) that helps a conference between two or more people can also take advantage of the filtering advantages disclosed herein. This is because unwanted text may be inserted electronically into normal chat messages and / or as start messages, end messages, or all of the above when users exchange messages It is. In this particular application, train the filter to automatically filter specific message content (text and images), capture unwanted content (commercials, promotions, advertisements, etc.) and tag it as junk Can be. Another example application is an SMS message on a cellular phone or similar device.

  One of the many objectives that obscure the internals of the spam filter is to prevent spammers from finding messages that are almost always guaranteed to go through without knowledge of how the filter works. It is. Another objective is to prevent spammers from understanding how spam filters work and prevent spammers from trying to reverse engineer filters. This is especially the case for spam boundaries where these minor changes to the message (such as adding or deleting some words or features of the message) affect whether the filter "sees" the message as spam. Applicable to nearby messages. For example, if a spammer finds that a message containing a word, such as “Viagra®”, is always classified as spam, he / she only has to craft the message without this word. Therefore, it would be advantageous to build a spam filter or spam filtering system that essentially prevents reverse engineering attempts.

  Many spam filters use a linear model. The linear model extracts message features such as words in the message and special features such as whether the message was sent at midnight. A weight or score is associated with each feature. The sum of all weights associated with the message is calculated to obtain a sum of weights (such as a total score). If the total weight exceeds a certain threshold, the particular message is not passed through and is not delivered. Conversely, if the total weight falls below a certain threshold, the message can reach the recipient.

  Other types of models can be used for spam filters, such as passing the score through a sigmoid function having the following formula:

  As a result, the score is converted into a number from 0 to 1 (for example, called the final score). This number can be further transformed into a probability that can help determine whether the message is spam.

  However, regardless of the model or strategy used for the spam filter, a spammer may attempt to determine a scoring scheme associated with at least one feature extracted from the message. Spammers create a large number of messages with different characteristics, which messages are classified as spam (for example, blocked from delivery), and which messages are not classified as spam (for example, delivered to recipients) This can be determined by examining. Finally, spammers try to estimate which feature score will result in such a classification.

  One approach to reducing the behavior of this type of spammer is to at least one of the various scores associated with the message in some slight way to effectively add noise to the actual score associated with the message. Including modifying. Score correction can be achieved, in part, by randomizing the total score, the final score, or both. For example, in a typical spam filter, the final score of a message can be compared to a certain (probability) threshold to determine whether the message is spam or more spam than non-spam. Therefore, by modifying the final score by adding or multiplying it with a random or pseudo-random number, when compared to a threshold, the final score value was previously within the threshold but now exceeds the threshold. Effectively increase or decrease by a small amount. Thus, at this point, the message can be tagged as spam or spam candidates with a slight change in overall score.

  Alternatively, the total score value affects whether the final score exceeds the threshold, so a similar type of modification can be made to it. Therefore, when the total score threshold or the final score threshold is reached, there is a high possibility that the message cannot be passed. In addition, by adding noise to the score of messages near spam or non-spam thresholds, spammers can determine whether the current status of the message (spam / non-spam, blocking / delivery, etc.) is due to some randomization characteristics, It becomes difficult to determine if it is due to some change in the content of the message.

  Referring now to FIG. 1, a schematic block diagram of a spam filtering system 100 that helps obfuscate the functionality of a spam filter according to one aspect of the present invention is shown. The system 100 includes a spam filter 110 that processes the message 120 to ultimately determine whether to classify the message as spam (or spammy) or non-spam (or non-spammy). A message score 130 is obtained.

  More specifically, spam filter 110 includes a filter scoring component 140 and a randomization component 150 operably coupled thereto. The filter scoring component 140 can use a machine learning system that evaluates the probability of whether the message 120 is spam. The filter can examine a particular characteristic of the message and provide its evaluation of the message. For example, features associated with any outgoing information and features associated with specific content of the message (such as embedded images, URLs, spam word and / or phrase characteristics, etc.) can be extracted and analyzed. The resulting score can then be changed by the randomization component 150 at least in part.

Randomization component 150 takes input from one or more input components 170 (eg, input component ₁ 172, input component ₂ 174 to input component _N 176, where N is an integer greater than or equal to 1). It includes a random number generator 160 that can receive and cause a small or slight increase or decrease in the resulting score value (eg, total score and / or final score if a sigmoid function is used).

  Input from the input component 170 may be in the form of a random or pseudo-random number added to each score before classifying the message as spam or non-spam. In this way, a spammer who has found a message that has passed through the filter with the message score changed has only found a message that will go through temporarily with a preferred random number. For example, assume that the random number added to a particular spam message is 0.7. For this particular message, adding 0.7 has a minor impact on the classification of spam messages. Thus, the message can go through. Spammers can then imitate this message to create future spam. However, since the random numbers added to it can always change, these future spam messages will not pass through without being noticed by spammers. Furthermore, it is difficult for a spammer to determine why a recent spam message cannot be passed while a previous message has passed.

  On the other hand, it is assumed that the random number is 1. This random number is large enough to work against certain spam messages. In other words, by adding the number 1 to the spam message score, the total or total score of the message may exceed a certain threshold at this point. As a result, the message is classified as spam and cannot pass through the filter. Therefore, reverse engineering of the filter becomes difficult by adding random numbers or pseudo-random numbers. This is because the score of a message, or whether a message is classified as spam, may or may not change with minor modifications to the message. Therefore, it remains impossible for the sender to determine whether the message has passed this time due to a minor modification to the message or a preferred random number.

  Another form of input may include the use of time. For example, by calculating a random number that depends on the date or time, a spammer needs to perform a long-term classification for reverse engineering of the filter. In some cases, the filter can be updated automatically on a regular basis, such as daily, so the filter itself, including the randomized component 150, which changes every four hours, changes before the spammers reverse engineer the filter. obtain. That is, the random number generator 160 can be programmed to use different random numbers at various time increments, eg, 5 minutes, 10 minutes, 1 hour, and / or 4 hour increments.

  In addition, spammers may find that messages are currently passing through in the first time increment. Immediately thereafter, the spammer can send out a few copies of the message to further “test” the filter. When it is found that these messages have passed, the spammer then sends millions of the messages. However, by doing so, the randomization component 160 has moved to another input component 170 and thus to another time increment (eg, a second time increment). Therefore, a different random number is added at the second time increment, thereby adversely affecting messages near the spam boundary, or even messages that were once classified as non-spam by the previous random number. As a result, spammers who have successfully passed through a filter with only a small percentage of messages cannot easily determine whether the message has passed through the filter or the random number has changed due to a small change to the message.

  Yet another type of input that can affect the random number generated by the randomization component 150 includes the user and / or domain receiving the message, and / or the domain where the spam filter is running. In particular, the generated random number may depend at least in part on the recipient of the message. For example, a spammer test user can be recognized by at least a portion of its identification information, such as its email address, its display name, and / or its domain. Thus, the random number generated for a spammer test user may be so low that spam messages can reach the test user almost anytime.

  In contrast, other domain names and / or other users who are designated to receive messages can make the generated random number so high that the spammer's message cannot pass through. Spammers can therefore find messages that reach the test user but not the other users. If the spammer is unaware that only the test user is receiving the spam, the spammer will be tricked into creating a future spam message that mimics the message that only reaches the test user. As a result, the amount of spam sent to other users other than the test user is reduced. However, by making the generated random number at least partially dependent on certain aspects of the message recipient, it becomes more burdensome for spammers to test spam filters.

  Alternatively, or in addition, the input can be based at least in part on the content of the message. This can be useful to prevent spammers from reverse engineering the internal mechanism of the spam filter. More specifically, the random number is calculated based on the content of the message. That is, a hash of the message content is obtained. The hash method is to convert a character string into a normal shorter fixed length value or key representing the original character string. In this example, the hash value calculated for each message is a random number.

  Spammers often try to modify the message content slightly to avoid spam filtering. Thus, if a spammer attempts to reverse engineer a message, a small change in the message content can cause the message score to change relatively significantly. For example, assume that message “X” is classified as spam. Spammers add words such as “FREE !!!” to make the message more spammy. However, because of the randomization aspect of the present invention, spammers believe that messages are currently classified as non-spam. Unfortunately, spammers mistakenly determine that the message “FREE !!!” does not make the message so spammy, but in fact the opposite is true.

  Considering randomization based on message content, spammers are convinced that they are unlikely to affect the message, for example, “the” or “on” to combat the potentially detrimental treatment of the message. Try to add any word you want. As a result, spammers can classify many messages after changing only these words and then calculate the average to determine which type of modification to the message will most successfully pass through the filter.

  In anticipation of such spammer behavior, a hash of features that essentially contribute to the score of the message can be computed. More specifically, recall that features can be extracted from messages. From the many extracted features, features whose contribution exceeds a given threshold (eg, threshold 0.01) can be selected. A hash of the selected feature can then be calculated and used as an input to the random number generator 160. Spammers are relatively difficult to reverse engineer the functionality of this type of spam filter, as it is relatively difficult to find which characteristics of a message contribute most to the score of the message.

  Alternatively or in addition, a hash of the IP address claimed by the sender can be calculated to determine which random number is generated for the message. Thus, again, it is particularly difficult for a spammer to determine which characteristic of the message is used to determine the hash and then which random number corresponds to the hash.

  When the randomization component 150 outputs a random number for a particular message, the random number can be added to the score or weight evaluated by the filter scoring component 140, for example. Finally, the total score or final score 130 of the message can be obtained to easily classify the message as spam or non-spam.

  Rather than having a probability function added to the message score to obscure the functionality of the spam filter, multiple spam filters can be deployed across multiple domains and / or for multiple users. In particular, the user can randomly or intentionally select one or more spam filters to use for message classification. The filter itself may be a different type of spam filter and / or may be trained using a different set of training data. Thus, it is almost certainly very difficult for a spammer to decipher which filter is used by a particular recipient of the spam message. In addition, multiple filters can be involved in message classification at a time, making it almost impossible to find messages that pass through the filter almost every time.

FIG. 2 is a block diagram illustrating an example of a multi-filter spam filtering system 200 according to an aspect of the present invention. System 200 includes a plurality of users 210 (e.g., up to user ₁ 212, user ₂ 214, and / or user _Y 216, where Y is an integer greater than or equal to 1). User 210 is generally the recipient of any incoming message, including spam messages. The system 200 also includes a plurality of spam filters 220 (eg, up to spam filter ₁ 222, spam filter ₂ 224, and / or spam filter _W 226, where W is an integer greater than or equal to 1).

  Each spam filter 220 can be trained based at least in part on a different set of training data. More specifically, the first filter 222 can be trained via a machine learning system using the first subset of training data. Similarly, the second filter 224 can be similarly trained using the second subset of training data. The training data of the second subset may or may not overlap with the data of the first subset. For example, the first filter 222 includes common terms and the second filter 224 includes rare words. The use of both filters means that the filter examines different criteria or features or content in the message before classifying the message as spam or non-spam.

  Similarly, certain data can be excluded from training one or more filters 210 as desired by the user. Excluded data can be excluded according to a random number generator. In addition, certain values can be assigned to some characteristics of the messages that are extracted and used to create the training data. Thus, the spam filter 220 can be dedicated to the user or private and can be customized to various degrees depending in part on the user's preferences and instructions.

  Thereafter, a filter selection component 230 operatively coupled to the plurality of users 210 and the plurality of spam filters 220 may at least partially select one or more filters 220 based on a particular user and / or user selection. Communication with the user 210 can be made to select. Alternatively, the filter selection may be random or based at least in part on a hash of message content or message size.

  As shown, the filter selection may be based in part on input received from the time input component 240. That is, different filters can be activated at different times of the day. For example, if the message is sent at 2 PM, multiple filters 220 can be used. However, if the message is sent at 3 am, only a subset of the filters 220 can be used, for example the first, second, fourth and sixth filters. Alternatively, a filter is selected according to time and only a single filter is used.

  In addition to the above, users 210 can be clustered into subgroups by clustering component 250 based on several similar qualities or characteristics or types. Similarly, the training data is clustered in the same way, resulting in a trained filter for at least one cluster or type of data. Accordingly, the filter selection component 230 can select one or more spam filters 220 corresponding to a particular cluster of users. Using multiple filters in a random or artificial manner as described herein may generally be more advantageous for spam filtering instead of relying on an optimal single spam filter. Even if a message passes this time, the next time the same or similar message is not necessarily passed if a different filter is randomly or randomly selected, reverse engineering, spam filter performance prediction, and every pass Finding a single message is more difficult for spammers. However, it is quite difficult if not impossible for a spammer to determine why a message cannot be passed every time or next time it is sent. This is because the internal mechanism of the filter cannot be easily reverse engineered and / or predicted. In addition, while a small amount of messages near the spam boundary may pass through, the delivery of the majority of “spam” messages can be effectively prevented by obfuscating the spam filtering process.

  Next, as shown in FIGS. 3 to 8, various methods according to the inventive subject matter will be described through a series of operations. The present invention is not limited by the order of operations, and some operations according to the present invention may be performed in a different order and / or concurrently with other operations than shown and described herein. I want you to understand. For example, those skilled in the art will appreciate that a method can alternatively be represented as a series of interrelated states or events, such as a state diagram. Moreover, not all actions shown for carrying out the method according to the invention may be necessary.

  Turning now to FIG. 3, a flow diagram of an example process 300 for randomizing the score of a message generated with a spam filter in accordance with an aspect of the present invention is shown. Process 300 begins at 310 and passes the message through a spam filter. At 320, the spam filter assigns a score to the message. The score can be based on common spam filtering systems and methods, such as extracting one or more message features, such that each feature has a weight associated with it. The sum of the weights is calculated and a message score is obtained. However, before the message is classified as spam or non-spam, a random or pseudo-random score can be scored at 330 to reduce reverse engineering of the spam filtering process.

  At 340, the final score of the message is obtained, and then at 350, the message is classified as spam or non-spam. A random or pseudo-random number added to the original score given by the spam filter can effectively add noise to the original score, allowing spammers to reverse engineer the spam filter and / or always pass through the spam filter. Try to suppress the discovery of messages. In any case, if a spammer knows how the spam filter works or can predict the response of the spam filter, it will be able to easily create a message that passes through the spam filter virtually every time. However, by incorporating a randomization component into the spam filter, spammers can change the message from a “spam” state to a “non-spam” state (or either due to an apparent minor change to the message, or some characteristic of the filter) It is difficult to define what has changed), which makes it almost impossible to reverse engineer spam filters.

  Random numbers or arbitrary factors change the message score just enough to affect messages near the spam boundary. In other words, this randomization technique most affects messages along the line between spam and non-spam messages. Other messages that are clearly spam (very high score or probability) or obviously non-spam (very low score or probability) are not substantially affected by randomization of the score. Furthermore, the pure random number added to the message score every time is not as effective as the present invention. Spammers can ultimately determine the probability or average probability that the message will pass through the filter, and thus can reverse engineer the filter, or always find the message that passes through the filter, and / or both. It is.

  The randomization of scores may depend on the type of input or inputs shown at 360 in FIG. 3 with reference to FIG. FIG. 4 shows a flow diagram of an example process 400 for determining which random number to use. At 410, the process 400 includes selecting at least one of an input type, time 420, user 430, and / or message content 440 for which the random number is determined accordingly.

  Time 420 refers to a time increment or time. More specifically, the random number used may vary depending on the time increment used, such as 5 minutes, 10 minutes, 30 minutes, 2 hours, or the time. For example, the value of the random number changes at midnight, and then changes again at 5 am, 7:30 am, 11:00 am, 4:13 pm, and the like.

  It may also affect which random number to use using the identity of the user 430 (display name, email address, etc.) and / or the domain of the user and / or the domain that sends and receives messages. Once this strategy is implemented, it becomes more difficult for spammers to test spam filters to determine which messages reach which users. Finally, message content 440 or at least a portion thereof can determine which random numbers are added to the original (basic) score.

  Referring now to FIG. 5, there is shown a flow diagram of an example process 500 for determining a random number to be added to the basic score of a message using the message content according to the present invention. In particular, the process 500 begins at 510 by calculating a hash of at least a portion of the message. For example, the random number can be calculated based on the body of the message. Therefore, when another message identical to this message appears, it is assigned the same random number or hash value. However, minor changes to the message body can make a significant change to the message score. For example, spammers attempt to add or remove seemingly meaningless words from a message in order to make the spam message less visible. This can be true if the spam message ratio is relatively small. However, since it is not known which type of word will increase or decrease the random number and / or the overall score of the message, for the majority of spam messages, the spam will be blocked from delivery.

  An alternative to hashing message content is to compute a hash of several features extracted from the message that contribute substantially to the score of the message. Features that contribute substantially to the scoring of the message can be changed randomly or randomly. In this way, spammers do not know the average, find the average through a large number of messages, and therefore cannot find a message that passes through whatever message characteristics are hashed. In addition, the hash is calculated on the sender's IP address. Thus, the classification of messages can depend directly on the sender's outgoing information, at least in part.

  At 520, a random number is added to the original or base score previously determined by the spam filter regardless of randomization. The total score for the message is then obtained at 530 and then at 540 the message can be classified as spam or non-spam.

  The randomization approach described above in FIGS. 3-5 herein is just one strategy used to prevent spammers from reverse engineering spam filters and / or to model spam filter performance. Another strategy involves placing multiple filters across multiple users and / or domains. Initially, multiple filters can be individually trained using various subsets of training data that may or may not overlap in some way. By inspecting and analyzing the message using multiple filters, the filtering system will not only focus on one particular aspect of the message but also examine different criteria within the message at essentially the same time. . Thus, the use of multiple filters facilitates providing a more accurate classification of messages and mitigating reverse engineering of the filtering system. This is because it is difficult to determine which filter was used and which aspects of the message were considered for classification.

  FIG. 6 shows a flow diagram of an example process 600 for training and using multiple spam filters in a customized manner based on user type clusters. Process 600 may begin at 610 by clustering users into one or more groups, eg, according to user type. At 620, the training data can be clustered in a similar manner to correspond to user type clusters. At 630, multiple filters can be individually trained for each cluster of training data. The plurality of filters are then ready for use at 640, whereby the messages corresponding to a particular cluster of user types can be used to classify the messages in that cluster. To further illustrate this, assume that filter R is trained with cluster R training data. Users in cluster user type R can then use the filter R to classify messages. It should be understood that the training data is clustered in the same way that users are clustered.

  Alternatively, as shown in the example process 700 of FIG. 7, multiple filters can be trained at 710 using various subsets of training data. Optionally, at 720, one or more features or related data can be extracted from one or more subsets of training data. Although not shown, some features extracted from the message can be forced to have some value or weight. At 730, the one or more spam filters are trained using the respective subset of training data, and then use it at 740 to process the message. As described above herein, at 750, the message can be classified as spam or non-spam. Although not shown, time can also be a factor in determining which spam filter to use to classify messages. In other words, a particular filter may only be available for some time periods of the day. Thus, the filter selection can be made randomly or randomly based in part on the user receiving the message and / or the time of day.

  To further provide context for various aspects of the present invention, FIG. 8 and the following description provide a general description of an operating environment 810 suitable for implementing various aspects of the present invention. Although the invention has been described in the general context of computer-executable instructions, such as program modules, executed by one or more computers or other devices, the invention is implemented in combination with other program modules. Those skilled in the art will appreciate that, and / or can be implemented as a combination of hardware and software.

  Generally, however, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular data types. The operating environment 810 is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Examples of other well-known computer systems, environments, and / or configurations suitable for use with the present invention include, but are not limited to, personal computers, handheld or laptop devices, multiprocessor systems, micro-computers, Processor-based systems, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including the systems or devices described above, and the like.

  With reference to FIG. 8, an example environment 810 for implementing various aspects of the invention includes a computer 812. Computer 812 includes a processing unit 814, system memory 816, and system bus 818. System bus 818 couples system components including, but not limited to, system memory 816 to processing unit 814. The processing unit 814 may be any of various available processors. Dual microprocessors and other multiprocessor architectures may also be used as the processing unit 814.

  The system bus 818 may be any of several types of bus structures including a memory bus or memory controller, a peripheral or external bus, and / or a local bus using any of the various bus architectures available. It may be a thing. Such architectures include, but are not limited to, 8-bit buses, Industrial Standard Architecture (ISA), MSA (Micro-Channel Architecture), Extended ISA (Extended Drive Local EDI), IDE (Integrated Drives Local EDI) Bus (VLB), PCI (Peripheral Component Interconnect), USB (Universal Serial Bus), AGP (Accelerated Graphics Port), PCMCIA (Personal Computer Memory Card) bus) and SCSI (Small Computer System Interface).

  The system memory 816 includes volatile memory 820 and nonvolatile memory 822. The basic input / output system (BIOS) includes a basic routine for transferring information between elements in the computer 812, such as during startup, and is stored in the non-volatile memory 822. Non-volatile memory 822 includes, but is not limited to, read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable ROM (EEPROM), flash memory, and the like. . Volatile memory 820 includes random access memory (RAM), which acts as external cache memory. Examples of RAM include, but are not limited to, synchronous RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), extended SDRAM (ESDRAM), and sync link DRAM ( It can be used in many forms such as SLDRAM) and DRDRAM (Direct Rambus DRAM).

  Computer 812 also includes removable / non-removable, volatile / nonvolatile computer storage media. FIG. 8 includes a disk storage device 824, for example. The disk storage device 824 includes, but is not limited to, devices such as a magnetic disk drive, a floppy (registered trademark) disk drive, a tape drive, a Jaz drive, a Zip drive, an LS-100 drive, a flash memory card, and a memory stick. . Further, the disk storage device 824 includes, but is not limited to, a separate storage medium, such as, but not limited to, a compact disk ROM device (CD-ROM), a CD recordable drive (CD-R Drive), a CD rewritable drive (CD-). RW Drive), or other storage media such as an optical disk drive such as a digital versatile disk ROM drive (DVD-ROM). In order to facilitate connection of the disk storage device 824 to the system bus 818, a removable or non-removable interface, such as interface 826, is generally used.

  It should be understood that FIG. 8 describes software that acts as an intermediary between the user and the basic computer resources described in a suitable operating environment 810. Such software includes an operating system 828 and the like. Operating system 828 can be stored on disk storage 824 and serves to control and allocate the resources of computer system 812. The system application 830 utilizes management of resources by the operating system 828 via program modules 832 and program data 834 stored either in the system memory 816 or the disk storage 824. It should be understood that the present invention can be implemented with various operating systems or combinations of operating systems.

  A user enters commands or information into computer 812 via input device 836. The input device 836 includes, but is not limited to, a pointing device such as a mouse, a trackball, a stylus, a touch pad, a keyboard, a microphone, a joystick, a game pad, a satellite dish, a scanner, a TV tuner card, a digital camera, and a digital video. There are cameras, web cameras, and the like. These and other input devices are connected to processing unit 814 by system bus 818 via interface port 838. Examples of the interface port 838 include a serial port, a parallel port, a game port, and a universal serial bus (USB). The output device 840 uses some port of the same type as the input device 836. Thus, for example, a USB port can be used to provide input to computer 812 and output information from computer 812 to output device 840. The output adapter 842 is provided to indicate that some of the output devices 840 require special adapters such as monitors, speakers, and printers. Examples of output adapter 842 include, but are not limited to, video cards and sound cards that provide a connection between output device 840 and system bus 818. Note that other devices and / or systems of devices, such as remote computer 844, provide input and output functionality.

  Computer 812 can operate in a networked environment using logical connections to one or more remote computers, such as remote computer 844. The remote computer 844 may be a personal computer, server, router, network PC, workstation, microprocessor-based device, peer device, or other common network node, and many or all of those generally described in connection with the computer 812. Contains the elements. For simplicity, only the memory storage device 846 is shown with the remote computer 844. Remote computer 844 is logically connected to computer 812 via network interface 848 and then physically connected via communication connection 850. Network interface 848 includes communication networks such as a local area network (LAN) and a wide area network (WAN). Examples of LAN technologies include an optical fiber distributed data interface (FDDI), a copper distributed data interface (CDDI), Ethernet (registered trademark) /IEEE802.3, and a token ring / IEEE802.5. WAN technologies include, but are not limited to, circuit-switched networks such as point-to-point links, integrated services digital networks (ISDN) and variations thereof, packet-switched networks, digital subscriber lines (DSL), and the like.

  Communication connection 850 refers to the hardware / software used to connect network interface 848 to bus 818. Communication connection 850 is shown within computer 812 for ease of explanation, but may be external to computer 812. The hardware / software required to connect to the network interface 848 is only an example, but internal technology such as an ordinary telephone modem, a cable modem, a modem such as a DSL modem, an ISDN adapter, an Ethernet card, and the like. There are external technologies.

  What has been described above includes examples of the subject invention. Of course, it is not possible to describe all possible combinations of components or methods to explain the invention, but it is understood that many other combinations and substitutions of the invention are possible. An engineer will understand. Accordingly, the present invention is intended to embrace all such alternatives, modifications and variances that fall within the spirit and scope of the appended claims. Further, to the extent that the term “comprising” is used in the detailed description or in the claims, such terms are the terms “comprising” that “comprising” is interpreted when used as transition terms in the claims. As inclusive.

1 is a schematic block diagram illustrating a system that helps obfuscate the spam filtering process in accordance with an aspect of the present invention. FIG. 1 is a schematic block diagram illustrating a system that uses multiple filters to help obfuscate the spam filtering process according to an aspect of the present invention. FIG. FIG. 6 is a flow diagram illustrating an example method that helps obfuscate the spam filtering process according to an aspect of the present invention. FIG. 6 is a flow diagram illustrating an example method that assists in determining a random or pseudo-random number according to an aspect of the present invention. FIG. 6 is a flow diagram illustrating an example method that assists in performing randomization based on the content of a partial message according to an aspect of the present invention. FIG. 5 is a flow diagram illustrating an example method that helps obfuscate the spam filtering process by training and using multiple spam filters according to an aspect of the present invention. FIG. 5 is a flow diagram illustrating an example method that helps obfuscate the spam filtering process by training and using multiple spam filters in accordance with an aspect of the present invention. 1 is a schematic block diagram illustrating an example communication environment according to the present invention.

Explanation of symbols

100 Spam Filtering System 110 Spam Filter 120 Message 130 Total Message Score 140 Filter Scoring Component 150 Randomization Component 160 Random Number Generator 172 Input Component ₁
174 Input component ₂
176 Input component _N
200 Multi-filter spam filtering system 210 Multiple users 212 User ₁
214 User ₂
216 User _Y
222 Spam filter ₁
224 Spam filter ₂
226 Spam filter _W
230 Filter selection component 240 Time input component 250 Clustering component

Claims (63)

One or more spam filters;
A randomization component that obfuscates the function of the spam filter and reduces reverse engineering of the one or more spam filters.   The randomization component randomizes the score of the filter so that a message that is close to a threshold and changed from one of the blocked or delivered messages is either a modification to the message or a randomization component. The system according to claim 1, which makes it difficult for a spammer to determine whether it has changed.   The system of claim 1, wherein the randomization component includes a random number generator that generates at least one of a random number and a pseudo-random number.   The random component includes one or more input components and provides input to the random number generator by the one or more input components to generate which random number for a particular message The system of claim 3, wherein the system assists in determining   The system of claim 1, wherein the random component generates a random number based at least in part on input received from one or more input components.   The system of claim 5, wherein the input from the one or more input components is based at least in part on time.   The system of claim 6, wherein the generated random number depends on at least one of a time and a time increment, and the generated number changes according to either the time or the current time increment.   The system of claim 5, wherein the input from the one or more input components is based at least in part on at least one of a user, a recipient, and a domain received from the message. .   The generated random number depends on at least one of a user, a recipient, and a domain that receives the message, and the generated number is an identification of the user, an identification of the recipient of the message 9. The system of claim 8, wherein the system varies according to any one of the domains receiving the message.   The system of claim 9, wherein the identification of either the user or the recipient includes at least one of a display name and / or an email address.   6. The system of claim 5, wherein the input from the one or more input components is based at least in part on the content of the message.   The system according to claim 11, wherein the generated random number varies according to at least a part of the content of the message.   By calculating a hash of the message content and using the hash value as the random number, even a slight change to the message content will result in a substantially large change to the generated random number. The system of claim 11.   12. The method of claim 11, wherein a hash of at least a portion of a feature extracted from a message is calculated to randomize a message score and help to randomize the function of the spam filter. system.   The system of claim 14, wherein the features used to calculate the hash have respective individual weights that are greater than some threshold.   12. The system of claim 11, wherein the function of the spam filter is obscured by helping to randomize message scores by calculating a hash of the sender's IP address.   A message that is at least a spam near the boundary is classified as spam at least once by substantially affecting the message that borders the boundary between spam and non-spam and randomizing the score of the message The system according to claim 1.   The system of claim 1, wherein the randomization component prevents a spammer from finding at least one message that substantially passes through a spam filter whenever it is sent. The spam filtering system includes:

In order to effectively modify spammer behavior and reduce reverse engineering of the filtering system, at least one of the total score value and the final score value is randomized using a sigmoid function having the formula: The system of claim 1, characterized in that: A multi-filter spam filtering system that suppresses reverse engineering of spam filters and virtually eliminates finding one message that always passes through spam filters,
A plurality of spam filters including at least a first spam filter and a second spam filter for processing and classifying messages;
A plurality of users including at least a first user and a second user;
A multi-filter spam filtering system, comprising: a filter selection component that selects one or more filters to be arranged for use by at least one of the plurality of users.   Time to communicate with the filter selection component such that one or more of the plurality of filters are selected and arranged for each user based at least in part on either time and time increments The system of claim 20, further comprising an input component.   The system of claim 21, wherein the time increment is any number of seconds, minutes, hours, days, weeks, months, and years.   The system of claim 20, wherein the filter selection component randomly selects the one or more filters.   The system of claim 20, wherein the filter selection component artificially selects the one or more filters.   The filter selection component is based at least in part on at least one of the respective user, the sender's domain, the domain running the filtering system, and the domain receiving the message. 21. The system of claim 20, wherein the one or more filters are selected to be placed for each user.   The system of claim 20, wherein the user is a recipient of the message.   The system of claim 20, wherein at least some of the plurality of spam filters are trained using one or more sets of training data via a machine learning system.   28. The system of claim 27, wherein the training data corresponds to features extracted from a message.   30. The system of claim 28, wherein at least some of the features extracted from the message are forced to have a specific value.   30. The system of claim 28, wherein at least some of the features extracted from the message are excluded from the training data.   29. The system of claim 28, wherein at least some of the features extracted from the message are clustered by feature type, and each cluster of data is used for training individual filters.   The at least some of the plurality of users are clustered by a user type associated with the cluster of feature types, and a spam filter corresponding to the user type is used for the user. The described system.   The first filter is trained using at least a first subset of training data, the second filter is trained using at least a second subset of training data, and the second subset of training data 21. The system of claim 20, wherein at least a portion of does not overlap with at least a portion of the first subset of training data.   Arrange to use the first filter and the second filter together so that different criteria and / or message characteristics are examined before classifying the message as spam or non-spam 34. The system of claim 33. Passing the message through a spam filter;
Calculating at least one score associated with the message;
Randomizing the score of the message before classifying the message as spam or non-spam;
Categorizing the message as spam or non-spam. A method for helping to obfuscate a spam filter.   36. The method of claim 35, wherein the at least one score associated with the message includes a final score and a total score.   The method of claim 36, wherein the total score is the sum of all scores associated with individual features extracted from the message.   37. The method of claim 36, wherein the final score is a sigmoid function of the total score and corresponds to a value from 0 to 1 indicating a probability that the message is spam or non-spam.   36. The method of claim 35, wherein randomizing the score of the message comprises adding at least one of a random number and a pseudo-random number to the score of the message. The number added to the score of the message is at least partly a time,
40. The method of claim 39, wherein the method is dependent on at least one of time increments. The number added to the score of the message is at least in part with the user;
A recipient of the message;
A domain receiving the message;
The sender's domain;
40. The method of claim 39, wherein the method is dependent on at least one of a machine name that operates the filter. The number added to the score of the message is at least partly a hash of the message content;
40. The method of claim 39, wherein the method depends on at least one of a hash of at least some of the features extracted from the message.   43. The method of claim 42, wherein the features used to calculate the hash each have a weight greater than zero.   43. The method of claim 42, wherein the feature used to calculate the hash can vary randomly or randomly depending on at least one of a time and a time increment.   40. The method of claim 39, wherein the number added to the score of the message depends at least in part on a hash of the sender's IP address.   40. The method of claim 39, wherein the number added to the score of the message depends on input from one or more input components.   Placing spam filters across multiple users to minimize reverse engineering of the spam filter and to prevent spammers from finding specific messages that always pass through the filter. How to keep it down.   The method of claim 47, wherein placing at least some of the plurality of spam filters depends on at least one of a time and a time increment.   48. The method of claim 47, wherein placing at least a portion of the plurality of spam filters depends on at least one or more users using the spam filter.   The method of claim 47, wherein placing at least some of the plurality of spam filters depends on at least one of a hash of message content and a size of the message.   48. The method of claim 47, further comprising selecting and randomly placing at least a portion of the plurality of spam filters.   48. The method of claim 47, further comprising selecting and artificially placing at least a portion of the plurality of spam filters.   The method of claim 47, wherein the plurality of spam filters are trained on a set of training data via a machine learning process. Training the spam filter comprises:
Creating a training data set;
Training at least a first spam filter using at least a first subset of training data;
Training at least a second spam filter using at least a second subset of training data, thereby preventing the second subset from being equivalent to the first subset of training data. 54. The method of claim 53. Training the spam filter comprises:
Clustering training data by type to correspond to user type clusters;
Training at least a first filter with a first cluster of data;
54. The method of claim 53, comprising training at least a second filter with a second cluster of data.   56. The method of claim 55, wherein the first filter is arranged for users belonging to a related type of cluster.   36. A computer readable medium comprising the method of claim 35.   48. A computer readable medium comprising the method of claim 47. A computer-readable medium storing a computer-executable component of a randomized component that obfuscates the functionality of a spam filter so as to suppress reverse engineering of the one or more spam filters.   60. The computer readable medium of claim 59, wherein the randomization component randomizes the score of the filter.   60. The computer-readable medium of claim 59, wherein the randomization component includes a random number generator that generates at least one of a random number and a pseudo-random number. A means for passing messages through a spam filter;
Means for calculating at least one score associated with the message;
Means for randomizing the score of the message before classifying the message as spam or non-spam;
And a means for classifying the message as spam or non-spam. Spam means characterized by including means for deploying multiple spam filters across multiple users so as to reduce reverse engineering of the spam filter and to prevent spammers from always finding specific messages that pass through the filter A system to minimize.

Images